When you install a Marketplace App, GoHighLevel shows you a list of what the app wants permission to do: read contacts, write to the calendar, manage conversations, and so on. Each item on that list is a scope. You grant only what the app needs, and it can do nothing else.
Scopes follow the principle of least privilege. A calendar scheduling app should need access to your calendar and contacts, but not to your billing settings or sub-account configuration. If an app requests more permissions than its function requires, that is a red flag.
GoHighLevel defines a standard set of scopes for its API: contacts.read, contacts.write, opportunities.read, conversations.write, and many more. Developers declare which scopes their app requires when they submit it to the Marketplace.
How OAuth Scope works
When a user installs a Marketplace App, GoHighLevel shows a consent screen listing the requested scopes. The user reviews and clicks Authorize. GoHighLevel issues an OAuth access token to the app that is restricted to those scopes only. The app includes the token in API calls, and GoHighLevel enforces the scope restrictions on every request.
Developers request scopes in their app configuration in the GoHighLevel developer dashboard. The narrower the scopes, the easier it is for users to trust the app. GoHighLevel may reject apps that request unusually broad scopes without clear justification.